1 Answer
1

Device is plugged in, and the software that manages the hardware bus for that device receives an interrupt (or other notification at the hardware level), and the bus driver enumerates attached devices, or performs other bus-specific hardware actions to identify the device.

Kernel requests to load a driver for the new hardware by calling /sbin/modprobe with hardware's bus/device/etc identifier.

In user-space, modprobe tries to find a matching driver-specified alias. (See /lib/modules/$(uname -r)/modules.alias for the complete list.) These will look different based on the hardware interface. For example, pci:v0000102Bd00002527sv*sd*bc*sc*i* for a PCI device vendor 102B, device 2527, and anything for subvendor, etc, or USB: usb:v2040p4982d*dc*dsc*dp*ic*isc*ip*.

once the device driver is loaded (or a new device that already had a driver is initialized), the driver in the kernel sends a notification of the loaded device to udev in userspace.

udev matches the notification against its list of rules in /lib/udev/rules.d/ and /etc/udev/rules.d. From here, the behavior is extremely specialized, based on the rules.

In the case of a USB disk, the 80-udisks.rules file is likely the best place to work from. These rules will use things like blkid and other helpers to probe the type and contents of a disk, populating all sort of configuration values including things like ENV{UDISKS_PRESENTATION_HIDE}="1" to ignore a disk for some reason. See "man 7 udisks" for details.

The udisks-daemon watches for devices to appear in the udev database, and presents them them as a discoverable list of devices over DBus. (See "udisks --enumerate".)

Various actions are configured in udisks, and the policy for allowing those actions can be seen in the policy file /usr/share/polkit-1/actions/org.freedesktop.udisks.policy. (Who can mount, umount, etc.)

Services that are interested in devices will listen for DBus events from udisks, and take actions when they see certain conditions. For example, GNOME's Nautilus (via gvfs volume-monitor) will request automounting for devices (via udisks, which will check its policy, mentioned above).

Once a filesystem has been mounted, those same listening services will take more actions. For example, Nautilus will ask if you want to open F-Spot when the common photo storage directory DCIM is found on a filesystem.